AI control evaluations often reset an agent’s memory between tasks, yet deployed agents may retain records of prior interventions. We investigate whether learning that an earlier attack was caught changes an agent’s ability to evade the "defer‑to‑trusted" (DtT) protocol, which replaces suspicious work with a trusted model’s solution. This study focuses on cross‑episode adaptation: does intervention history affect attack behavior on a subsequent task with different objectives and a fresh environment? Experiments use ControlArena’s Infrastructure‑as‑Code (IaC) and SHADE‑Arena testbeds, where agents must complete a main task while covertly pursuing a harmful side objective. For each successor task we compare a history‑conditioned attempt with a no‑history baseline. The retained history either merely states that the previous submission was replaced or additionally shows the trusted model’s replacement. On the IaC benchmark, Claude Opus 4.8 shows a sharp drop in successful sabotage when given history: the joint success rate of main and side objectives falls from 77% to 12% when only the replacement is disclosed, and to 38% when the trusted model’s output is also shown, while main‑task success remains essentially unchanged. Condensing the history weakens this effect, suggesting that the retained context matters more than simple intervention feedback. GPT‑5.4 exhibits no significant change on the same benchmark. On SHADE‑Arena, GPT‑5’s sabotage rate also decreases, but the reduction is not statistically significant. Across all models, history conditions, and deferral thresholds, intervention history never increases the rate of sabotage that survives DtT. These results indicate that intervention history can alter subsequent attack behavior, but its impact depends on both the model and the retained context.
Review